Hacker News Reader

Hacker News

Comment by hoopism | Hacker News Reader

Parent Full thread

hoopism

To recap the facts:

- Man drives car on public highway @ speeds of up to 70mph

- Hackers turn on windshield wipers and fluid to blur view

- Hackers Blare music and obscure any comms link to driver

- Hackers disable vehicle on Highway at location with no shoulder

And there are people who are not only ok with type of experiment but think there should be more of it.

I understand that these exploits need to get attention... but I really can't stop thinking about my wife and kids being behind this guy while he shows how dangerous this can be.

I applaud the person who notified the police.

View on HN

https://en.wikipedia.org/wiki/Institutional_review_board is how normal people deal with this.

No, I think notifying the police, who then notify the IRB is how normal people would deal with this. I don't expect the normal person knows about the IRB (I'm not surprised it exists, but I was unaware of it).

In a similar vein, if you notified your local police about a kidnapping they would notify the FBI, because kidnapping is the FBI's jurisdiction.

By "deal with this" I meant "deal with the fact that researchers have giant blind spots about the ethical impacts of their research."

I don't expect Joe Random to know to contact these guys' IRB, when they likely don't have one at all.

Ah, fair enough. I interpreted it as you saying people should have contacted the IRB, not the police, regarding this breach of ethics in research.

> but I really can't stop thinking about my wife and kids

What about all those wives and kids that would have been endangered if the flaw had continued to go unfixed and exploited in a more malicious manner?

Can we please not make "BUT THINK OF THE CHILDREN" arguments? Appealing to emotion makes arguments, well, emotional.

The two options here are not "test on highway with other drivers" and "let flaw exist with no testing and no exposure". There are many ways to responsibly test this while not endangering others on a public road. For example, using a private road, a large empty parking lot, an abandoned airforce base, the salt flats, etc.

The Mythbusters test stuff like this all the time. What do they do? Use an abandoned airforce base or the Utah salt flats. Rule number one, don't endanger the public.

> For example, using a private road, a large empty parking lot, an abandoned airforce base, the salt flats, etc.

The researchers did many of these things, according to the article. They were ignored by auto makers.

If you increase the danger of a situation to increase it's exposure, you can't be surprised when that causes repercussions. I doubt they will go to jail, but I do think alerting the authorities was the right call.

In fact, they may have been counting on that. If they really want to increase the exposure of a story, start a public debate. The easiest way to do that? Get some public outrage going. They called this all out, they'll need to deal with the consequences.

I don't disagree with you on that. The researchers (and WiReD) should certainly be aware of the risks here, and be prepared to accept the repercussions thereof.

On the other hand, while two wrongs don't make a right, I'm glad that the researchers made that choice, so long as said choice results in manufacturers actually taking car security seriously for once.

Did they publicize it on Wired like they did with this post?

I'm reasonably sure that if they had tested in a private track and made a public article it would have the same effect as what they did in their post.

In essence, the publicity factor is the most important, not where they tested it.

Different hackers, over a year ago, in a semi-controlled environment, on Vice. Didn't have much of an effect.

http://www.vice.com/video/how-to-hack-a-car

I didn't watch the full video, but at 6:45 it states

"Unlike most previously recorded car hacks, this demonstration was performed wirelessly over cellular networks. The vehicle shown is modified with third-party hardware for demo purposes. In stock form it is not vulnerable to these attacks"

which is quite different from the level of vulnerability showcased in the Wired article.

> What about all those wives and kids that would have been endangered if the flaw had continued to go unfixed and exploited in a more malicious manner?

Because, he said anything like that right? What a gratuitous use of a strawman.

It's not appealing to emotions, it's pretty rational to think this experiment could have easily caused an accident and hurt people. We all rationally know that driving is one of the most dangerous forms of travel. Seriously, a car is a dangerous, fast, multi-ton piece of metal, it's not a toy to experiment on when other people's safety is at stake. Respect the vehicle and the damage it could cause.

The exploits can and will be published and reported on quite easily without these reckless theatrics.

This comment is shockingly naive. Can you really not think of any other way to demonstrate the vulnerability they found without taking the whole thing onto open public roadways? Safety researchers who work for auto manufacturers don't go out on the highway to do crash test exams and we trust their outcomes.

Obviously they don't. But chrysler was informed and created a patch. But what they didn't do is ensuring that it gets rolled out to everyone vulnerable.

By saying this you are basically saying there was no reasonable alternative method of exposing this.

I am unwilling to say that. This argument that somehow the ends justify the means when there was a clearly more safe means has to stop. It's just ignorant.

> By saying this you are basically saying there was no reasonable alternative method of exposing this.

No, he's saying you need a better argument.

>What about all those wives and kids that would have been endangered

>Can we please not make "BUT THINK OF THE CHILDREN" arguments

Is there anything more human than to react with fear and anger towards scientists who make a difficult problem easy to understand?

There's one thing more human than that, and that is to react with fear and anger when someone senselessly endangers their lives.

Maybe just the desire to extend the lives of those we love.

Tell your wife not to tailgate and get off her facebook while driving, and all will be well.

Stop acting like it takes negligence on the part of the other drivers to make this a dangerous situation.

Now imagine the exploit being used by a blackhat. The hackers aren't the problem here. The fact that somebody can even control cars over the Internet at all is.

You seem to be confused.

Because a dangerous threat exists does not give a researcher license to endanger the public to prove it. This is especially the case when a safer alternative to demonstrate this exploit easily exists.

Robbers could enter your home and hold your family at gunpoint AT ANY TIME. That does not give me the right to prove to you how easy it is by entering your home and scaring the crap out of your family.

1) This is a dangerous exploit

2) This was a dumb way to demonstrate it

Those are not mutually exclusive.

> This is especially the case when a safer alternative to demonstrate this exploit easily exists.

And when said safer demonstrations are ignored by manufacturers, as was the case here?

> This is especially the case when a safer alternative to demonstrate this exploit easily exists.

If you read the article, you'd know that said safer alternative was already attempted and presented to auto manufacturers, only to be met with dismissal.

Did you read the article? Here are two quotes:

"Second, Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference."

"WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks, first sparked when Markey took note of Miller and Valasek’s work in 2013."

> "Second, Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference."

I did admittedly miss the "nine months" portion of that, but that's still only one company out of many.

> "WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks, first sparked when Markey took note of Miller and Valasek’s work in 2013."

If you read further, you'll see the paragraphs on Markey's letters to auto makers regarding the 2013 findings; Markey's own findings only reinforce my point further.

Also, note that my point - that auto makers mostly ignored Miller and Valasek, according to the article - would not include senators (unless said senators build cars, of course).

> I did admittedly miss the "nine months" portion of that, but that's still only one company out of many.

Yes, it's the company that owns Jeep. The company that has a demonstrated the security flaw. How different automakers responded to different security issues isn't related to this article or discussion.

> Also, note that my point - that auto makers mostly ignored Miller and Valasek, according to the article - would not include senators (unless said senators build cars, of course).

Senators may not build cars, but they can (and are trying to) force auto makers to take security seriously.

The argument in this comment chain has been whether this problem could get the attention it needed without such a dangerous publicity stunt. The fact that automaker and lawmakers were convinced to take action by less dangerous demonstrations shows that this stunt was not necessary.

> How different automakers responded to different security issues isn't related to this article or discussion.

It is related to the article when the article discusses those responses.

> The fact that automaker and lawmakers were convinced to take action by less dangerous demonstrations shows that this stunt was not necessary.

One automaker (even this is dubious; Chrysler seriously expects people to believe that the only way to patch a bug that allows total control over a car's transmission and brakes - let alone the rest of the car - is via a USB stick, and that over-the-air patching isn't an option? Please.) and two senators. There are dozens more automakers and 98 more senators to convince. Hopefully the demo helps make that a better situation.

Meanwhile, a bunch of Dodges and Chryslers are driving around America totally susceptible to UConnect bugs, and a very large number of new cars on the road don't even have the most basic safety precautions (like, you know, not connecting the brakes and transmission to the Internet willy-nilly).

The convincing so far has been negligible. Hopefully that'll change soon, before someone with less-benevolent motives follows in Miller's and Valasek's footsteps.

And yet somehow the sins of the auto manufacturers in no way excuses the reckless behavior demonstrated in this video. It is possible that more than 1 person/entity in this story is in the wrong. Its clear you've already made up your mind and have posted more than a dozen comments here defending the researchers, so I'm not sure what more can be said. The ends simply do not justify the means.

I agree that both sides are in the wrong, actually. I've even stated my disagreement with the methodology in several of those "dozen" comments.

Most of those comments, however, are only clearing up a specific misconception: the belief that the researchers jumped straight to a "live" test before trying tests in closed conditions. My idea of "right" v. "wrong" does not factor into doing my part to ensure that discussions on this matter are based on accurate information.

My "defense" of the researchers is more just identifying a lesser evil. Between the evil of a couple of nerds hacking one car and the evil of auto manufacturers willingly putting hudreds of thousands - if not millions - of innocent people in mortal danger, I'd sooner take the former (assuming that it actually makes a difference re: security priorities of auto manufacturers; in reality, even this particular demonstration is probably insufficient, though perhaps I'm just jaded).

First off, a "dangerous thing you can do" and "exploit" are not synonyms. So examples like anthrax attacks or home invasion are stupid and massively miss the point.

Secondly, nobody would give a fuck about this exploit if it was performed in controlled environment. The researchers knew it because they did this kind of stuff before. Guess what, the cars did not become any safer!

This much should be obvious to anyone with a hacking mindset. The comments in this thread read more like "Moms Against Drunk Driving Bulletin Board" than "Hacker News".

Actually home invasion is an "exploit" of the home security (i.e. locked doors / windows).

Just because they do it from behind a screen doesn't make it a less culpable crime. Computers don't insulate you from ethics...

We put locks on our doors to prevent people from entering. They have always been exploitable but we use threat of laws to prevent it. Now we put locks in our software to prevent people from entering it (encryption). Somehow this generation believes that these locks are exempt from decency and law. It's sad that people think exposing vulnerabilities at any cost is righteous. There's plenty of people researching security in responsible ways. These two are not in that camp.

Have fun... it's no different than kicking your neighbors door down and tell him to pay you for exposing his security flaw. Still makes you are jerk.

Using your logic, the government doing control biological tests on an unaware population (e.g. to test the spread patterns and inform their response to an actual event) is ok because terrorists/foreign governments could do much worse with (e.g.) weaponized Anthrax. I somehow doubt that you would be ok with such actions by the government (though I could be wrong).

It's not either/or. You're presenting a false dilemma. You can demonstrate the problem without doing it where you put real lives in danger. The researchers acted recklessly.

> You can demonstrate the problem without doing it where you put real lives in danger.

Indeed. And according to the article, they already did. The manufacturers ignored them.

Well, no, the manufacturers didn't ignore them. They responded with a patch, but the researchers didn't like their response.

Still doesn't matter though. There are a million shades between quiet disclosure and outright stupidity that would still make headlines.

1) They could have let the "test dummy" in on what was going to happen, so they could give feedback as to when it was safe to do so.

2) They could have ensured constant two-way communication.

3) They could have done it when nobody was on the road.

> They responded with a patch, but the researchers didn't like their response.

It was my understanding that the patch was released in response to the live highway test, not the prior tests in controlled environments.

> They could have let the "test dummy" in on what was going to happen, so they could give feedback as to when it was safe to do so.

The article makes it sound like they did.

> They could have ensured constant two-way communication.

Indeed they could've. I agree with you about the recklessness of this particular element of the test.

> They could have done it when nobody was on the road.

Perhaps, and I agree that maybe they should've coordinated with local authorities (if they didn't already). However, between "do the test with vehicles on the road" and "don't do the test at all", I'd certainly pick the former.

Not to mention that the urgency involved with other vehicles on the road factors into the effectiveness of the demonstration.

Regarding the patch timeline, the article makes it clear they had been working on the patch for months before this went public.

> Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference.

With respect to letting the driver in on it, it's pretty clear they withheld most information:

> Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch

And with respect to this:

> However, between "do the test with vehicles on the road" and "don't do the test at all", I'd certainly pick the former.

Oh look, another false dilemma. Between those two, I'd pick neither, and do the test responsibly.

> With respect to letting the driver in on it, it's pretty clear they withheld most information:

The reporter knew there were going to be attacks in the first place. There was also plenty of reason to believe said attacks could severely impair safety.

> Oh look, another false dilemma.

It's a trilemma; the concept of "do the test 'responsibly'" was already implied, so I merely provided the other outcomes. There's "perfect execution of demonstration" and "no demonstration"; between that is a spectrum of perfection, on which this demonstration happens to lie somewhere near the lower-middle.

I don't disagree that the demo could've been done with more safety precautions, but the desire to do a "live" demonstration like this seems pretty reasonable, and even a demonstration lower on the perfection spectrum is preferable to the bottom end of "nothing at all".

I take it you also can't stop thinking about your wife and kids being behind someone whose engine stalls, or who slams one's brakes to avoid hitting a deer, or who runs out of gas on an interstate (which has happened to me, thanks to my car's faulty fuel gauge). You must have a lot on your mind.

I don't agree with the methodology, either, but based on the information in the article, it sounded like the researchers didn't have much of a choice, seeing as how prior demonstrations were casually dismissed by the automakers. The auto manufacturers and the public both need a wakeup call, and this is a much more sane wakeup call than the even worse alternative of outright-malicious crackers breaking into vehicles en masse and reducing highway traffic to shrapnel in ridiculously-large pileups.

"I didn't have a choice but to fire a gun in the middle of a crowd of people. It was just a wake up call!. You always have a choice. One of those choices is to do the demo, but with the proper safety authorities helping. One of those choices is to perform the demo in a place where it is safe to pull your car over. One of those choices is to do the demo somewhere where the speeds are a little lower.

All of those things you listed are actual emergency situations that are hard to control. This is one thing where they were in full control of, and still decided to do it anyway. They had a choice, and they chose to endanger the public.

There's a big difference between firing a gun and a car gradually slowing down.

Yes, the researchers could have made better choices. They could have made worse choices, too. The "danger" here is significantly exaggerated given the descriptions of the scenario in the article (gradual slowdowns, contrary to popular belief, aren't that hard to react to in a timely manner), and it certainly does not compare to firing a gun.

Reply on news.ycombinator.com